Reflected Cross-Site Scripting Vulnerability in Broken Link Manager Plugin
CVE-2025-12629
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 24 November 2025
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-12629?
The Broken Link Manager plugin for WordPress versions up to 0.6.5 is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper sanitization and escaping of parameters before they are output back to the web page. This weakness could be exploited by attackers to inject malicious scripts, particularly targeting high-privilege user roles such as administrators, potentially leading to unauthorized actions or data breaches.
Affected Version(s)
Broken Link Manager 0 <= 0.6.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.